Set up OpenShift with cert-manager certificate

Use this installation path when you deploy on OpenShift and you want cert-manager to issue and renew the front-end and backend certificates automatically.

In this mode:

Cert-manager creates the certificates and the related TLS secrets.
You do not create TLS secrets before you install the chart.
On OpenShift, you must update the Route after the certificates are ready.

Before you begin

Complete the common setup steps from Set up FlashSystem.ai container.
Verify that cert-manager is installed in the cluster.
Identify the Issuer or ClusterIssuer that your cluster uses.
Ensure that your Route hostname resolves to the OpenShift router.

Installing TLS certificates

Configure values.yaml

Do not create TLS secrets manually for this mode.

Edit values.yaml and set the following fields:

namespace:
  create: false
  name: "flashsystem-app"

appName: "flashsystem-app"

imagePullSecrets:
  - name: icr-io

platform: openshift

route:
  enabled: true
  hosts:
    - host: "<APPLICATION_DNS_NAME>"

certificates:
  certManager:
    enabled: true
    issuer:
      name: "letsencrypt-prod"
      kind: "ClusterIssuer"
  frontend:
    mode: "certmanager"
    certManager:
      dnsNames:
        - "<APPLICATION_DNS_NAME>"
      duration: "2160h"
      renewBefore: "360h"
  backend:
    mode: "certmanager"
    certManager:
      duration: "2160h"
      renewBefore: "360h"

Update these values:

Replace <APPLICATION_DNS_NAME> with your DNS name.
Replace issuer.name and issuer.kind with the Issuer or ClusterIssuer that your cluster uses.

Install the Helm chart

Install the chart in the target project:

helm install flashsystem-app . -f values.yaml -n flashsystem-app

Wait for certificates to become ready

Cert-manager creates the TLS secrets asynchronously. Wait until both certificates are ready:

oc get certificates -n flashsystem-app

oc wait --for=condition=Ready \
  certificate/flashsystem-app-frontend-tls \
  -n flashsystem-app --timeout=300s

oc wait --for=condition=Ready \
  certificate/flashsystem-app-backend-tls \
  -n flashsystem-app --timeout=300s

If the certificates do not become ready, review the cert-manager logs:

oc logs -n cert-manager -l app=cert-manager

Update the Route after certificate issuance
OpenShift Routes store certificate content in the Route specification. The initial helm install can create the Route before cert-manager creates the secrets. After the certificates are ready, run helm upgrade to update the Route with the issued certificate:
```
helm upgrade flashsystem-app . -f values.yaml -n flashsystem-ap
```
Verify that the Route includes TLS configuration:
```
oc describe route flashsystem-app-route -n flashsystem-app | grep -A 5 "TLS"
```